CVE-2019-0247

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SAP Cloud Connector, before version 2.11.3, allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
SAP SE	SAP Cloud Connector	< 2.11.3

References

https://launchpad.support.sap.com/#/notes/2696233Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985Vendor Advisory
https://launchpad.support.sap.com/#/notes/2696233Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985Vendor Advisory

Timeline

Published: Jan 8, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-02485.9Under certain conditions SAP Gateway of ABAP Application Server (fixed in SAP_GWFND 7.5, 7.51, 7.52, 7.53; SAP_BASIS 7.5) allows an attacker CVE-2019-02497.5Under certain conditions SAP Landscape Management (VCM 3.0) allows an attacker to access information which would otherwise be restricted.CVE-2019-02516.1The Fiori Launchpad of SAP BusinessObjects, before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs, resulting in C CVE-2019-02545.4SAP Disclosure Management (before version 10.1 Stack 1301) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scri CVE-2019-02558.1SAP NetWeaver AS ABAP Platform, Krnl64nuc 7.74, krnl64UC 7.73, 7.74, Kernel 7.73, 7.74, 7.75, fails to validate type of installation for an CVE-2019-02565.5Under certain conditions SAP Business One Mobile Android App, version 1.2.12, allows an attacker to access information which would otherwise CVE-2019-02578.8Customizing functionality of SAP NetWeaver AS ABAP Platform (fixed in versions from 7.0 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7 CVE-2019-02588.8SAP Disclosure Management, version 10.01, does not perform necessary authorization checks for an authenticated user, resulting in escalation CVE-2019-02599.8SAP BusinessObjects, versions 4.2 and 4.3, (Visual Difference) allows an attacker to upload any file (including script files) without proper CVE-2019-02619.8Under certain circumstances, SAP HANA Extended Application Services, advanced model (XS advanced) does not perform authentication checks pro CVE-2019-02625.4SAP WebIntelligence BILaunchPad, versions 4.10, 4.20, does not sufficiently encode user-controlled inputs in generated HTML reports, resulti CVE-2019-02654.9SLD Registration of ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding th